Microsoft on Tuesday launched safety updates to deal with a set of 59 flaws throughout its software program, together with six vulnerabilities that it stated have been exploited within the wild.
Of the 59 flaws, 5 are rated Crucial, 52 are rated Essential, and two are rated Reasonable in severity. Twenty-five of the patched vulnerabilities have been labeled as privilege escalation, adopted by distant code execution (12), spoofing (7), info disclosure (6), safety characteristic bypass (5), denial-of-service (3), and cross-site scripting (1).
It is price noting that the patches are along with three safety flaws that Microsoft has addressed in its Edge browser for the reason that launch of the January 2026 Patch Tuesday replace, together with a Reasonable vulnerability impacting the Edge browser for Android (CVE-2026-0391, CVSS rating: 6.5) that would enable an unauthorized attacker to carry out spoofing over a community by benefiting from a “person interface misrepresentation of essential info.”
Topping the checklist of this month’s updates are six vulnerabilities which were flagged as actively exploited –
- CVE-2026-21510 (CVSS rating: 8.8) – A safety mechanism failure in Home windows Shell that permits an unauthorized attacker to bypass a safety characteristic over a community.
- CVE-2026-21513 (CVSS rating: 8.8) – A safety mechanism failure in MSHTML Framework that permits an unauthorized attacker to bypass a safety characteristic over a community.
- CVE-2026-21514 (CVSS rating: 7.8) – A reliance on untrusted inputs in a safety choice in Microsoft Workplace Phrase that permits an unauthorized attacker to bypass a safety characteristic domestically.
- CVE-2026-21519 (CVSS rating: 7.8) – An entry of useful resource utilizing incompatible sort (‘sort confusion’) within the Desktop Window Supervisor that permits a certified attacker to raise privileges domestically.
- CVE-2026-21525 (CVSS rating: 6.2) – A null pointer dereference in Home windows Distant Entry Connection Supervisor that permits an unauthorized attacker to disclaim service domestically.
- CVE-2026-21533 (CVSS rating: 7.8) – An improper privilege administration in Home windows Distant Desktop that permits a certified attacker to raise privileges domestically.
Microsoft’s personal safety groups and Google Risk Intelligence Group (GTIG) have been credited with discovering and reporting the primary three flaws, which have been listed as publicly identified on the time of launch. There are presently no particulars on how the vulnerabilities are being exploited, and in the event that they had been weaponized as a part of the identical marketing campaign.
“CVE-2026-21513 is a safety characteristic bypass vulnerability within the Microsoft MSHTML Framework, a core part utilized by Home windows and a number of functions to render HTML content material,” Jack Bicer, director of vulnerability analysis at Action1, stated. “It’s attributable to a safety mechanism failure that permits attackers to bypass execution prompts when customers work together with malicious information. A crafted file can silently bypass Home windows safety prompts and set off harmful actions with a single click on.”
Satnam Narang, senior workers analysis engineer at Tenable, stated CVE-2026-21513 and CVE-2026-21514 bear a “lot of similarities” to CVE-2026-21510, the primary distinction being that CVE-2026-21513 may also be exploited utilizing an HTML file, whereas CVE-2026-21514 can solely be exploited utilizing a Microsoft Workplace file.
As for CVE-2026-21525, it is linked to a zero-day that ACROS Safety’s 0patch service stated it found in December 2025 whereas investigating one other associated flaw in the identical part (CVE-2025-59230).
“These [CVE-2026-21519 and CVE-2026-21533] are native privilege escalation vulnerabilities, which implies an attacker will need to have already gained entry to a susceptible host,” Kev Breen, senior director of cyber risk analysis at Immersive, advised The Hacker Information through e-mail. “This might happen by way of a malicious attachment, a distant code execution vulnerability, or lateral motion from one other compromised system.”
“As soon as on the host, the attacker can use these escalation vulnerabilities to raise privileges to SYSTEM. With this stage of entry, a risk actor may disable safety tooling, deploy extra malware, or, in worst-case situations, entry secrets and techniques or credentials that would result in full area compromise.”
The event has prompted the U.S. Cybersecurity and Infrastructure Safety Company (CISA) to add all six vulnerabilities to its Recognized Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Govt Department (FCEB) businesses to use the fixes by March 3, 2026.
The replace additionally coincides with Microsoft rolling out up to date Safe Boot certificates to switch the unique 2011 certificates that can expire in late June 2026. The brand new certificates might be put in by way of the common month-to-month Home windows replace course of with none extra motion.
“If a tool doesn’t obtain the brand new Safe Boot certificates earlier than the 2011 certificates expire, the PC will proceed to perform usually, and present software program will hold operating,” the tech big stated. “Nonetheless, the gadget will enter a degraded safety state that limits its capability to obtain future boot-level protections.”
“As new boot‑stage vulnerabilities are found, affected programs turn out to be more and more uncovered as a result of they’ll not set up new mitigations. Over time, this will additionally result in compatibility points, as newer working programs, firmware, {hardware}, or Safe Boot–dependent software program could fail to load.”
In tandem, the corporate stated it is also strengthening default protections in Home windows by way of two safety initiatives, Home windows Baseline Safety Mode and Consumer Transparency and Consent. The updates come beneath the purview of the Safe Future Initiative and Home windows Resiliency Initiative.
“With Home windows Baseline Safety Mode, Home windows will transfer towards working with runtime integrity safeguards enabled by default,” it famous. “These safeguards make sure that solely correctly signed apps, companies, and drivers are allowed to run, serving to to guard the system from tampering or unauthorized adjustments.”
Consumer Transparency and Consent, analogous to Apple macOS Transparency, Consent, and Management (TCC) framework, goals to introduce a constant strategy to dealing with safety choices. The working system will immediate customers when apps attempt to entry delicate sources, resembling information, the digital camera, or the microphone, or after they try to put in different unintended software program.
“These prompts are designed to be clear and actionable, and you will at all times have the flexibility to evaluation and alter your selections later,” Logan Iyer, Distinguished Engineer at Microsoft, stated. “Apps and AI brokers may even be anticipated to satisfy larger transparency requirements, giving each customers and IT directors higher visibility into their behaviors.”
